Archive · 15 Nov 2025
India Notifies DPDP Rules, Experts Welcome New Digital Privacy Regime
Imagine India now has a new set of rules, called the DPDP Rules, to protect your personal information online.
The government officially announced these rules recently.
This means companies, like social media platforms and online services, must clearly tell you what information they are collecting about you and how they plan to use it.
You will also have an easier way to say 'no' to them using your data or to report problems.
Some experts are very happy about this, saying it's a big step for privacy in India, especially with new technologies like AI.
They believe these rules will help companies handle data more responsibly.
Companies have about a year and a half to get ready and follow all the new requirements.
Experts also say it’s important for companies to build a culture of trust around data privacy, not just follow rules.
The next important step will be to see how the new Data Protection Board explains and enforces these rules.
India has officially notified the Rules under the Digital Personal Data Protection Act (DPDPA), 2023, establishing its first personal data protection regime.
Organizations, including social media and online gateways, must now explain to users what data is collected and how it will be used.
Users will have easier ways to revoke consent and complain to the Data Protection Board (DPB) about data protection infractions.
Companies have 18 months to comply with administrative requirements, while consent managers must register with the DPB within 12 months.
Industry experts welcome the move, highlighting it as a significant step for digital privacy, AI governance, and establishing operational accountability and a culture of trust.
- Who
- Ministry of Electronics and Information Technology (MeitY), social media sites, online gateways, organizations handling personal data, users, consent managers, industry experts (Ivana Bartoletti, Nikhil Narendran, Jaspreet Singh), Data Protection Board (DPB).
- What
- Notification of Rules under the Digital Personal Data Protection Act (DPDPA), 2023, establishing India's personal data protection regime.
- When
- Rules notified on Friday (November 14, 2025, assumed date for context), with compliance deadlines of 18 months for companies and 12 months for consent managers.
- Where
- India
- Why
- To operationalize India's first dedicated personal-data protection regime, strengthen digital ecosystem, promote trust, and ensure accountability in data handling.
Emphasis on New Era and Robust Governance
Focus on Operationalization and Future Interpretation
Significance of DPDP Rules Notification
Emphasis on New Era and Robust Governance
Experts like Ivana Bartoletti emphasize that the notification of DPDP Rules marks a new era of privacy in India, crucial for AI development and strengthening the digital ecosystem, highlighting robust data governance, clear responsibilities, consent, and privacy by design.
Focus on Operationalization and Future Interpretation
Nikhil Narendran sees the notification as putting an end to uncertainty for India Inc., providing an 18-month runway for compliance and focusing on the practical steps organizations need to take, such as data mapping and training, and anticipating how the Data Protection Authority will interpret and enforce the rules.
Compliance Approach for Organizations
Emphasis on New Era and Robust Governance
Ivana Bartoletti suggests that the new rules enable organizations to grow sustainably and accountably as technology becomes more embedded in daily life.
Focus on Operationalization and Future Interpretation
Jaspreet Singh stresses that compliance is not a checklist but a culture of trust and privacy governance that must be institutionalized, with a focus on embedding privacy by design and operationalizing privacy as a continuous assurance function.
- Law Name
- Digital Personal Data Protection Act (DPDPA), 2023
- Rules Notification Date
- Friday (November 14, 2025, assumed date for context)
- Compliance Deadline for Companies
- 18 months from notification
- Registration Deadline for Consent Managers
- 12 months from notification
- Key Requirements for Organizations
- Provide detailed explanation of data gathered and its use, enable easy consent revocation, clear responsibilities, consent, privacy by design
- Governing Body
- Data Protection Board (DPB)
Sources
After two years, India’s data privacy law comes to force
Centre Notifies DPDP Rules To Regulate Personal Data
Govt issues DPDP Rules with phased rollout and new requirements for data fiduciaries
Centre notifies Digital Personal Data Protection Rules 2025 — Check provisions, implementation plan, penalties
Govt notifies DPDP Act operationalising India’s first digital privacy law
DPDP Act mandates e-commerce, social media firms to delete inactive user data after 3 years
Govt notifies DPDP Rules 2025: New data protection norms to roll out over 12–18 month
Centre issues DPDP Act rules, puts India’s first digital privacy law into effect
E-commerce, social media firms must erase inactive user data after 3 years: DPDP Act
Data privacy law comes into force
Govt released rules for Digital Personal Data Protection
Startups, Big Tech and Cloud Firms Brace for India’s New Data Compliance Era
Businesses must race to meet 18-month deadline for data protection norms: Experts on DPDP rules
Centre Notifies Digital Personal Data Protection (DPDP) Act Rules
Businesses must race to meet 18-month deadline for data protection norms: Experts on DPDP rules
Small-Town Businesses Race To Understand New Data Rules As Compliance Deadline Nears
DPDP Rules: Firms get breathing space, but work begins now
India Notifies DPDP Rules, 2025, Bringing Landmark Data Law Into Force
Clearer Consent, Faster Breach Alerts: What India’s New Data Rules Mean For Users
Mint Explainer: What the new data privacy law means for India's startups
India Activates Digital Privacy Law
